CVE-2019-19844PYSEC-2019-16GHSA-VFQ6-HQ5R-27R6
Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.11.27, 2.2.9, 3.0.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 on Exploit-DB, 3 proofs of concept on GitHub
Summary
Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)
Timeline
- CVE published
- Public exploit on Exploit-DB
EDB-47879
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- n/a n/a
Version range not reported
- djangoPyPI
fixed in 1.11.27; From 2.2 · fixed in 2.2.9
- djangoPyPI
fixed in 1.11.27
- djangoPyPI
From 2.0 · fixed in 2.2.9
- djangoPyPI
From 3.0 · fixed in 3.0.1